Browse code

mbr: scan bootstrap code region of header

Kevin Lin authored on 2014/02/11 01:16:03
Showing 1 changed files
... ...
@@ -104,7 +104,7 @@ int cli_scanmbr(cli_ctx *ctx)
104 104
         return CL_ENULLARG;
105 105
     }
106 106
 
107
-    /* sector size calculation */
107
+    /* sector size calculation, actual value is OS dependent */
108 108
     sectorsize = MBR_SECTOR_SIZE;
109 109
 
110 110
     /* size of total file must be a multiple of the sector size */
... ...
@@ -133,6 +133,13 @@ int cli_scanmbr(cli_ctx *ctx)
133 133
         return ret;
134 134
     }
135 135
 
136
+    /* MBR is valid, examine bootstrap code */
137
+    ret = cli_map_scan(*ctx->fmap, 0, MBR_BASE_OFFSET, ctx, CL_TYPE_FILE_ANY);
138
+    if ((ret != CL_CLEAN) &&
139
+        !((ctx->options & CL_SCAN_ALLMATCHES) && (ret == CL_VIRUS))) {
140
+        return ret;
141
+    }
142
+
136 143
     /* check that the partition table has no intersections - HEURISTICS */
137 144
     if ((ctx->options & CL_SCAN_PARTITION_INTXN) && (ctx->dconf->other & OTHER_CONF_PRTNINTXN)) {
138 145
         ret = mbr_primary_prtn_intxn(ctx, mbr, sectorsize);